Security<\/p>\n
Secret to their success:\u00a0Using the right model for the right security job<\/p>\n
Two agentic bug-hunting systems from Microsoft and Google-owned Wiz show that when it comes to finding and remediating software vulnerabilities, at least two models\u2019 minds work better than one – and Wiz tells us it\u2019s adding a third.<\/p>\n
Wiz on Monday said Project Atlas, its bug-hunting AI agent, bested Anthropic\u2019s Mythos Preview and OpenAI\u2019s GPT-5.5 Cyber with its vulnerability-analysis skills, achieving a 90.9 percent success rate on CyberGym, and uncovering more than 200 zero-day security holes in widely used open-source code.<\/p>\n
Meanwhile, Microsoft boasted<\/a> its MDASH bug-hunting harness<\/a> scored a 95.95 percent success rate on CyberGym, also beating Mythos, Gemini and GPT on the same benchmark for evaluating how well AI systems find real vulnerabilities in the code.<\/p>\n For comparison, OpenAI\u2019s GPT-5.5 Cyber scored 85.6 percent on CyberGym<\/a>, and its GPT-5.6 Sol scored 83.6 percent. Anthropic\u2019s Mythos 5 reproduced the target vulnerability on 83.8 percent of CyberGym challenges. And Google\u2019s Gemini 3.5 Flash Cyber in CodeMender achieved an 83.2 percent success rate.<\/p>\n The secret to both Atlas and MDASH\u2019s success, according to the vendors, is that they use the right model for the right security job.<\/p>\n Atlas uses Claude Opus 4.6 with GPT-5.5, Nir Ohfeld, head of vulnerability research at Wiz, told The Register. \u201cWe’re now working to incorporate Gemini, which is well timed given Wiz’s recent work with DeepMind on Gemini Flash Cyber,\u201d he added.<\/p>\n Microsoft\u2019s MDASH – a combination of red-team agents that find and simulate real, exploitable vulnerabilities and attack paths, and green-team agents that remediate the issues – combines MAI-Cyber-1-Flash, based on Microsoft AI (MAI)\u2019s internally developed MAI-Thinking-1<\/a> reasoning model, and GPT-5.4.<\/p>\n MAI-Cyber-1-Flash is designed to handle up to 90 percent of all tasks, with MDASH detecting, patching, and validating vulnerabilities before handing the remaining 10 percent of more complex tasks to the larger GPT-5.4.<\/p>\n \u201cWe were able to take an off-the-shelf model, within our harness, a multi-agent and multi-model implementation, and we achieved the best results you could have,\u201d Hayete Gallot, executive vice president of Microsoft Security, said on Monday.<\/p>\n Atlas isn\u2019t commercially available yet – it\u2019s used internally, and stems from Wiz\u2019s efforts to understand how frontier models can be used for advanced code scanning. But it\u2019s proof that \u201cno single model is best at everything, and none stays state of the art for long,\u201d Ohfeld and fellow Wiz kid Yuval Avrahami wrote<\/a> in a Monday blog.<\/p>\n